VPC Creation Fails with Transport Zone Mismatch Error on Distributed Transit Gateway

Products

• VMware NSX

Issue/Introduction

• You observe that creating a Virtual Private Cloud (VPC) in the default NSX project fails.
• The VPC status reports a "failed" state, and you see an error message similar to the following in the NSX Manager UI: 

Found errors in the request. Please refer to the related errors for details. [Routing] TIER0 and TIER1 routers should belong to same transport zone.

• In the /var/log/proton/nsxapi.log, you find entries indicating a transport zone mismatch between the Transit Gateway (TGW) and the VPC Tier-1 router: 

Tier0 router #### is on transport zone #### and Tier1 router LogicalRouter/#### is on transport zone ####. Tier1 router should belong to same transport zone as tier0

• There is no Tier 0 logical router deployed.

Environment

VCF NSX 9.1

Cause

This issue occurs when the system's default overlay transport zone (TZ) is changed, after a VLAN attachment is already created on the default project's Distributed Transit Gateway (DTGW).

1. When you first create the DTGW VLAN attachment, the TGW Logical Router (LR) is set to the current system default overlay TZ.
2. If you subsequently change the system default overlay TZ to a different TZ, any new VPC you create picks up the new system default.
3. This creates a mismatch because the existing TGW LR is still associated with the old transport zone, causing the realization of the VPC gateway interface to fail.

Resolution

Workaround

To resolve the transport zone mismatch, you must force the Transit Gateway to adopt the new default transport zone:

1. Navigate to the DTGW in the NSX Manager UI.
2. Delete the existing attachment (change from Distributed VLAN attachment to no attachment).
3. Re-attach the Transit Gateway to the VLAN connection.

You should subscribe to this article to be updated on the fix status by following the instructions in Subscribe to a Broadcom knowledge article by article or product